Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
Which requests are treated as "static content" and excluded from WAF inspection (extension, method, query and body conditions); is this safe?
Short answer
While Do not WAF static contents is on (on by default), a request is treated as static if it meets all four conditions: the path ends with one of the defined static extensions, the method is GET, the request has no query part and the body is empty. These requests do not enter the WAF inspection at all; signature scanning, structural inspections, the blacklist inspection and learning are skipped, and they are counted in the Whitelisted series on Dashboard. Requests that carry a query or a body, or that come with a method other than GET, are inspected even if their extension is static; in this way, requests that hide parameters behind a static file name cannot get out of scope. The setting is vService-wide; if the application processes paths with static extensions dynamically, the setting is turned off from the Whitelist & Blacklist window.
How Does It Work?
Do not WAF static contents is on the whitelist side of the Whitelist & Blacklist settings. For a request to be treated as static, four conditions must be met together:
| Condition | Treated as static | Inspected |
|---|---|---|
| The end of the path | .txt .bmp .jpeg .jpg .pdf .ps .ttf .svg .svgz .webp .css .woff .woff2 .csv .gif .png .tif .tiff .mid .midi .swf .doc .docx .ppt .pptx .xls .xlsx .mp4 .flv .mov .wmv .avi .ogg .mkv .mpg | All other extensions; e.g. .js, .ico, .html, .map, .json, .xml |
| Method | GET | HEAD, POST and all other methods |
| Query | None | Present (including /logo.png?v=2) |
| Body | Empty | Not empty |
- The extension is compared with the end of the path case-sensitively; the extensions in the list are lowercase.
- For a request treated as static, WAF does not run at all: signature scanning, structural inspections and the Blacklist Protection inspection are not done, no record is written for learning, and no Event Logs record is created. The whitelist takes precedence over the blacklist.
- Static requests are counted in the Whitelisted series in the WAF Inspection Distribution panel on the Dashboard of the vService.
- The setting only skips the WAF inspection; the rules in the Actions list of the vService are applied to these requests as well.
Is It Safe?
| Situation | Assessment |
|---|---|
| Static files are served as they are on the server | In a GET request with no query and no body, the data to be inspected is only in the path; the setting can be left on and the WAF load decreases |
| A request with a parameter or a body added behind a static file name | It enters the inspection, since the four conditions are looked for together |
The application generates paths with static extensions dynamically (e.g. a /report/123.pdf report page) or processes the value in the path | These requests do not enter the inspection; the setting is turned off |
| Path inspection is wanted for attacks embedded in the path (e.g. path traversal) | If paths that end with a static extension should also be inspected, the setting is turned off |
The Setting in TR7
The setting is vService-wide and common to all Virtual Host Groups. In the Left Monitor Panel → WAF-Protected vServices → vService → WAF Management tab, the pencil icon of the Whitelist & blacklist card in the Inspection & Blocking section is clicked, the Do not WAF static contents box is checked or unchecked, and Edit at the bottom of the window is clicked (Whitelist & Blacklist Edit screen). While the setting is on, the Static content bypasses WAF inspection line appears on the card (card). The change is applied without a separate deployment step; in a cluster setup, it is also sent to the peer device with the default auto-sync, and if Manual Sync Mode is on, it is sent to the peer device manually.
The extension list is not changed from the interface. To exclude specific requests from the inspection, Whitelist Condition is used.
Common Misconceptions
- "Every request with a static extension is excluded from the inspection." If there is a query, a body or a method other than GET, the request is inspected; the four conditions are looked for together.
- "Static requests are caught by the blacklist." The whitelist takes precedence over the blacklist; Blacklist Protection is not applied in WAF for these requests. If all requests of the source are to be blocked, a blacklist condition is used on the Load Balancer side (Blacklist IP Category).
- "
.jsand.htmlfiles are also treated as static." These extensions are not in the list; these requests are inspected. - "Static requests contribute to learning." Requests that do not enter the inspection are not recorded for learning either; for this reason, they do not appear in the Page type list.
How it is done in the documentation
